Fix 6 React Doctor findings and pin the CI engine to 0.9.3

[Wibias]

Summary

• React Doctor now scans clean under 0.9.3: lazy-initialize four refs (pause/observer sets in useCodexAccountPool, the OAuth generation map in useProvidersOAuth, Integrations tab refs) so new Set() / new Map() are not rebuilt and discarded on every render.
• Removed two dead exports (IconSparkle, DataSurfaceSkeletonBlock) flagged by unused-export. Two of the six findings were already reportable by the pinned 0.9.2 engine but live in files the changed-file CI scope never scanned; the other four are new in 0.9.3.
• Pinned the CI workflow engine and both GUI doctor scripts from 0.9.2 to 0.9.3 so the newer rule set gates PRs and prepush; updated gui/README.md and the workflow-contract tests to match.

Validation

• react-doctor@0.9.3 --scope full --no-telemetry — 0 diagnostics
• react-doctor@0.9.2 --scope full --no-telemetry — 0 diagnostics
• bun run typecheck — pass
• cd gui && bun run lint — pass
• cd gui && bun test tests — 535 pass, 0 fail
• cd gui && bun run build — pass
• bun run privacy:scan — pass
• bun run doctor:gui:if-changed — no issues
• bun test tests/ci-workflows.test.ts — 66 pass, 0 fail
• bun run test — 7562 pass, 14 fail; all 14 are pre-existing symlink-creation failures that reproduce identically on a clean checkout of upstream/dev (see Limitations)

Review notes

• oauthLoginGenerationRef moved into useProvidersOAuth, its only consumer: react-doctor 0.9.3 rejects the null-guarded lazy-init pattern when the ref is passed into another hook, and eslint react-hooks/refs rejects it when the ref arrives as a hook parameter. Owning it locally satisfies both.
• The stable ref was removed from the cancelLoginOAuth dependency array; ref identity is stable across renders, so callback recreation is unchanged.
• version: 0.9.2 to version: 0.9.3 is the only workflow change; the action SHA pin, blocking: warning, and read-only permissions are untouched.

Limitations

• bun run test reports 14 failures on this Windows host: symlinkSync throws EPERM because symlink creation needs Developer Mode/admin. The identical 14 tests fail on a clean checkout of upstream/dev without this PR.

Summary by CodeRabbit

• Improvements
  • Updated the React Doctor tooling to version 0.9.3.
  • Improved internal handling of account pauses, observers, tab navigation, and OAuth sign-ins.
  • Added shuffle, grip, star, and filter icons.
  • Removed an unused sparkle icon.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 953523cb-39bb-4f88-aff6-35ed7fd7168c

📥 Commits

Reviewing files that changed from the base of the PR and between 56b4181 and d233403.

📒 Files selected for processing (10)

• .github/workflows/react-doctor.yml
• gui/README.md
• gui/package.json
• gui/src/components/data-surface.tsx
• gui/src/hooks/useCodexAccountPool.ts
• gui/src/icons.tsx
• gui/src/pages/Integrations.tsx
• gui/src/pages/Providers.tsx
• gui/src/pages/use-providers-oauth.ts
• tests/ci-workflows.test.ts

💤 Files with no reviewable changes (1)

• gui/src/icons.tsx

---

📝 Walkthrough

Walkthrough

The PR updates React Doctor references to 0.9.3, moves OAuth generation state into its hook, lazily initializes GUI refs, and changes several component exports and icons.

Changes

GUI maintenance

Layer / File(s)	Summary
React Doctor version update .github/workflows/react-doctor.yml:53, gui/package.json:12-13, gui/README.md:52, tests/ci-workflows.test.ts:2352,2374	The workflow, GUI scripts, documentation, and CI assertions now use React Doctor 0.9.3.
OAuth generation state ownership gui/src/pages/use-providers-oauth.ts:1,10-11,25-26,38-43,52-61,77,89-91,142,152-156, gui/src/pages/Providers.tsx:176	useProvidersOAuth creates and uses its own login-generation map. Providers no longer passes the removed ref.
Lazy GUI ref initialization gui/src/hooks/useCodexAccountPool.ts:113-114,123-124,136-142,161,287-294, gui/src/pages/Integrations.tsx:75-76,106,135-136	Pause-token sets, observer sets, and integration tab refs now initialize lazily. Access and cleanup use the initialized values.
Icon and component exports gui/src/icons.tsx:46-67, gui/src/components/data-surface.tsx:16	IconSparkle is replaced by IconShuffle, IconGrip, IconStar, and IconFilter. DataSurfaceSkeletonBlock is no longer exported.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• lidge-jun/opencodex#465: Updates the same React Doctor workflow, GUI script, README, and CI references.
• lidge-jun/opencodex#565: Introduces related Codex account pausing behavior used by useCodexAccountPool.
• lidge-jun/opencodex#589: Updates the same React Doctor version references.

Suggested labels: chore

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the six React Doctor fixes and the CI engine update to version 0.9.3.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}